It is impossible to pass CompTIA SY0-401 exam without any help in the short term. Come to Exambible soon and find the most advanced, correct and guaranteed CompTIA SY0-401 practice questions. You will get a surprising result by our Leading CompTIA Security+ Certification practice guides.

2021 Dec SY0-401 download

Q511. A security analyst needs to logon to the console to perform maintenance on a remote server. Which of the following protocols would provide secure access? 

A. SCP 

B. SSH 

C. SFTP 

D. HTTPS 

Answer: B 

Explanation: 

Secure Shell (SSH) is a tunneling protocol originally used on Unix systems. It’s now available for both Unix and Windows environments. SSH is primarily intended for interactive terminal sessions. SSH is used to establish a command-line, text-only interface connection with a server, router, switch, or similar device over any distance. 


Q512. Speaking a passphrase into a voice print analyzer is an example of which of the following security concepts? 

A. Two factor authentication 

B. Identification and authorization 

C. Single sign-on 

D. Single factor authentication 

Answer: A 

Explanation: 

Two-factor authentication is when two different authentication factors are provided for 

authentication purposes. 

Speaking (Voice) – something they are. 

Passphrase – something they know. 


Q513. A system administrator is using a packet sniffer to troubleshoot remote authentication. The administrator detects a device trying to communicate to TCP port 49. Which of the following authentication methods is MOST likely being attempted? 

A. RADIUS 

B. TACACS+ 

C. Kerberos 

D. LDAP 

Answer: B 

Explanation: 

TACACS makes use of TCP port 49 by default. 


Q514. A company executive's laptop was compromised, leading to a security breach. The laptop was placed into storage by a junior system administrator and was subsequently wiped and re-imaged. When it was determined that the authorities would need to be involved, there was little evidence to present to the investigators. Which of the following procedures could have been implemented to aid the authorities in their investigation? 

A. A comparison should have been created from the original system's file hashes 

B. Witness testimony should have been taken by the administrator 

C. The company should have established a chain of custody tracking the laptop 

D. A system image should have been created and stored 

Answer: D 

Explanation: 


Q515. The Chief Technical Officer (CTO) has tasked The Computer Emergency Response Team (CERT) to develop and update all Internal Operating Procedures and Standard Operating Procedures documentation in order to successfully respond to future incidents. Which of the following stages of the Incident Handling process is the team working on? 

A. Lessons Learned 

B. Eradication 

C. Recovery 

D. Preparation 

Answer: D 

Explanation: 

Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. Developing and updating all internal operating and standard operating procedures documentation to handle future incidents is preparation. 


Abreast of the times SY0-401 exam question:

Q516. In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis? (Select TWO). 

A. Take hashes 

B. Begin the chain of custody paperwork 

C. Take screen shots 

D. Capture the system image 

E. Decompile suspicious files 

Answer: A,D 

Explanation: 

A: Take Hashes. NIST (the National Institute of Standards and Technology) maintains a National Software Reference Library (NSRL). One of the purposes of the NSRL is to collect “known, traceable software applications” through their hash values and store them in a Reference Data Set (RDS). The RDS can then be used by law enforcement, government agencies, and businesses to determine which fi les are important as evidence in criminal investigations. 

D: A system image is a snapshot of what exists. Capturing an image of the operating system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it. 


Q517. Joe, the Chief Technical Officer (CTO), is concerned about new malware being introduced into the corporate network. He has tasked the security engineers to implement a technology that is capable of alerting the team when unusual traffic is on the network. Which of the following types of technologies will BEST address this scenario? 

A. Application Firewall 

B. Anomaly Based IDS 

C. Proxy Firewall 

D. Signature IDS 

Answer: B 

Explanation: 

Anomaly-based detection watches the ongoing activity in the environment and looks for abnormal occurrences. An anomaly-based monitoring or detection method relies on definitions of all valid forms of activity. This database of known valid activity allows the tool to detect any and all anomalies. Anomaly-based detection is commonly used for protocols. Because all the valid and legal forms of a protocol are known and can be defined, any variations from those known valid constructions are seen as anomalies. 


Q518. A security administrator has implemented a policy to prevent data loss. Which of the following is the BEST method of enforcement? 

A. Internet networks can be accessed via personally-owned computers. 

B. Data can only be stored on local workstations. 

C. Wi-Fi networks should use WEP encryption by default. 

D. Only USB devices supporting encryption are to be used. 

Answer: D 

Explanation: 

The concern for preventing data loss is the concern for maintaining data confidentiality. This can 

be accomplished through encryption, access controls, and steganography. 

USB encryption is usually provided by the vendor of the USB device. It is not included on all USB 

devices. 


Q519. Sara, a security engineer, is testing encryption ciphers for performance. Which of the following ciphers offers strong encryption with the FASTEST speed? 

A. 3DES 

B. Blowfish 

C. Serpent 

D. AES256 

Answer: B 

Explanation: 

Blowfish is an encryption system invented by a team led by Bruce Schneier that performs a 64-bit block cipher at very fast speeds. Blowfish is a fast, except when changing keys. It is a symmetric block cipher that can use variable-length keys (from 32 bits to 448 bits). 


Q520. Company XYZ has encountered an increased amount of buffer overflow attacks. The programmer has been tasked to identify the issue and report any findings. Which of the following is the FIRST step of action recommended in this scenario? 

A. Baseline Reporting 

B. Capability Maturity Model 

C. Code Review 

D. Quality Assurance and Testing 

Answer: C 

Explanation: